You can remove the administrator privilege from domain users and still allow users to start certain applications as administrators.
With privilege elevation, a user can start certain pre-configured applications, which the Dynamic Environment Manager agent runs elevated on the local desktop, as if the user is a member of the administrators group.
Note: Privilege elevation is not supported for members of the Network Configuration Operators group.
Important: The Privilege Elevation feature grants temporary administrator privileges to a user. The feature must be used only for specific use cases by administrators. It is not intended as a security feature. Use additional security measures to prevent malicious use.
You can configure the following privilege-elevation types.
- Elevated applications
- User-installed applications
- Elevated tasks
See Configure Applications for Privilege Elevation.
For elevated applications, privilege elevation occurs after user logon. To elevate an application outside of the logged-in period of the user, select Elevated task as the privilege-elevation type. For examples of types of tasks to configure using the elevated-task feature, see Configure Logon and Logoff Tasks and Configure Import and Export Tasks.
| Mode | Description | ||||||||
|---|---|---|---|---|---|---|---|---|---|
| Elevated applications |
Select the applications you want to elevate.
You can elevate applications based on a particular hash, path, or publisher, or on command-line arguments.
.EXE files. By default, child processes are not elevated. To elevate child processes manually, select Also elevate child processes when you configure an application for privilege elevation. | ||||||||
| User-installed applications |
Select a folder, from which the user installs elevated applications. You can only use path-based configuration for the user-installed applications.
Child processes are not elevated, unless they are located in the same folder as the elevated applications, the temporary folder of the user, or the temporary folder of the system.
User-installed applications support .MSI and .EXE files. | ||||||||
| Elevated tasks |
Select the application you want to run as an elevated task.
.EXE files. By default, child processes are not elevated. To elevate child processes manually, select Also elevate child processes when you configure an application for privilege elevation.
To launch the configured task, you can call FlexEngine.exe with command-line arguments ‑LaunchTask "name-of-task" or you can use a Dynamic Environment Manager task. See Configure Logon and Logoff Tasks and Configure Import and Export Tasks.
Dynamic Environment Manager logs status messages for elevated task launches to the FlexEngine-ElevatedTasks.log log file. |
Note: If you use application blocking, by default only applications in Program Files and Windows are allowed to run. You might need to create an allow setting to run the application.
Was this page helpful?